Vulnerability Discovery

What this phase covers

Vulnerability discovery proves what is exploitable before you exploit it. Each page here confirms a specific weakness and states what attack it enables. The goal is a clear list of confirmed findings before the exploitation phase begins.

Open networks and WEP networks are the highest severity findings — both are immediately exploitable with no further steps. Unlocked WPS networks are the next priority, particularly those running on Ralink or Realtek chipsets which are likely Pixie Dust vulnerable. WPA2 without MFP confirms the deauthentication attack surface for handshake capture. WPA Enterprise with unvalidated certificates is a critical finding that exposes Active Directory credentials. Captive portal bypass maps which evasion techniques apply before attempting access.

Priority order

Work through targets in this order: open networks first (no attack needed, just capture), then WEP (broken encryption, crackable in minutes), then unlocked WPS (PIN or Pixie Dust bypasses the passphrase entirely), then WPA2 PSK without MFP (deauth and crack), then WPA Enterprise (rogue AP credential harvest). A network may have multiple weaknesses — an AP can be WPA2 PSK without MFP and also have WPS enabled, in which case try WPS first since it recovers the passphrase directly without needing to crack a handshake.

Flows into

Each confirmed finding maps directly to an exploitation page: open networks to plaintext capture, WEP to WEP cracking, WPS to Pixie Dust or PIN brute-force, WPA2 PSK to handshake capture and cracking, WPA Enterprise to EAP harvesting, and captive portals to the captive portal credential harvesting page.